Files
AILang/crates/ail/tests/user_adt_new_mono_pin.rs
T
Brummel 76b21c00eb feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55)
Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`:
every fn-type slot on every signature carries an explicit `own` or
`borrow`, no defaulted position survives anywhere (model 0008 §2,
spec 0062). The parser rejects a bare fn-type slot; `borrow-return`
and `borrow-over-value` reject at the signature; the corpus is
migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap
⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode
leak is fixed: an owned heap return now drops exactly once (live=0,
acceptance criterion 5).

This was the easy half. Removing the default ACTIVATED a family of
drop paths that `Implicit` had silently skipped — the pre-cutover
language was leaking (and in places mis-dropping) here rather than
crashing, because an Implicit scrutinee turned the drop off. Making
the modes explicit (Own) turned those paths on and exposed two
latent-bug clusters, all fixed RED-first as part of this cutover:

Drop-soundness family (four legs):
  A. lit-sub-pattern double-free — the desugar re-matched the same
     owned scrutinee in the lit fall-through; fixed by grouping
     consecutive same-ctor arms into one match (bind fields once),
     in ailang-core desugar.
  B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern
     desugar rebound the owned scrutinee via `Let $mp = xs`, which
     bumped consume_count and suppressed the existing fn-return
     partial_drop. Fixed by not rebinding a bare-Var scrutinee
     (one husk-freeing mechanism, not two).
  C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields —
     the per-ADT drop fn was emitted once from the polymorphic
     TypeDef, defaulting type-var fields to ptr and rc_dec'ing
     inline Ints (segfault). Fixed with per-monomorph drop
     functions (new ailang-codegen::dropmono): the drop set is
     collected from the lowered MIR, value-type fields are skipped,
     heap fields still freed once; monomorphic-concrete ADTs keep
     their byte-identical un-suffixed drop symbol.
  D. static Str literal passed to an `(own Str)` param — the
     literal lowers to a header-less rodata constant; the callee's
     now-active rc_dec read its length field as a refcount and
     freed a static address (segfault). Fixed with the missing
     fourth StrRep::Static→Heap promotion in lower_to_mir's App arm,
     gated on Own mode (borrow args stay static, no regression).

over-strict-mode lint over-fired: it suggested `(borrow V)` for
value-typed params (which `borrow-over-value` rejects — own is the
only legal mode there) and fired on `(intrinsic)` bodies (whose
consumption the linearity walk cannot observe). Tightened to skip
both; contract 0008 updated to the narrowed firing scope.

Irreversible step — canonical-form hash reset (model 0008 §6,
acceptance criterion 6). Every signature now carries explicit modes,
so the hashable canonical JSON changed for every module. RATIFY:
the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin,
mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the
ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot
golden were regenerated once, deliberately, as the intended one-time
consequence of removing the mode elision from the canonical form —
not a regression. Each regenerated hash verified deterministic across
two runs.

Also fixes a pre-existing latent failure surfaced by the verification
gate, unrelated to this cutover: the `every_contract_names_a_resolvable_
ratifying_test` resolver (design_index_pin) could not resolve the
" + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`)
that the #57 audit-close (dfdc65f) introduced — it shipped red on that
commit. Resolver taught the dual-link form, mirroring its sibling.

Verification: cargo test --workspace = 731 passed, 0 failed (twice,
stable); e2e 102 passed, no binary exits non-zero (corpus crash-free);
grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop
fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K,
head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first
husk-dec attempt, the over-strict derivation premise, the leg-B fix
direction) were each treated as a real design/spec gap and rediagnosed,
not patched over.

Supersedes #54 (return-position-only leak patch). Precondition #57
(linearity hardening) was already met. Spec docs/specs/0062, plan
docs/plans/0121.

closes #55
2026-06-02 00:03:46 +02:00

117 lines
4.5 KiB
Rust

//! E2E regression pin for #53 — a monomorphic `(new T args)` over a
//! user-defined ADT that declares a `new` fn must build, not just check.
//!
//! Property protected: for a single-module program with `(data Counter
//! (ctor MkCounter (con Int)))`, a `(fn new …)` constructing it, and a
//! `main` that calls `(new Counter 42)`, the whole pipeline
//! (`ail check` AND `ail build --alloc=rc`) succeeds and the binary
//! runs. The monomorphic `(new T …)` form carries no `NewArg::Type`, so
//! the `Term::New` desugar lowers it to `(app T.new <values…>)` — a
//! type-scoped `Var` callee `Counter.new` (desugar.rs:1091-1097). The
//! checker's TypeDef-first ladder resolves that callee, so `ail check`
//! is clean; codegen's call-lowering does not, so the call falls through
//! to the indirect path and aborts with `unknown variable: `Counter.new``
//! (CodegenError::UnknownVar, ailang-codegen/src/lib.rs:1712). The check
//! pass and the codegen pass disagree on whether `Counter.new` resolves
//! — a check↔codegen mismatch on the monomorphic dotted constructor
//! callee.
//!
//! This is distinct-root from #51: #51 was the polymorphic
//! `(new T <elem> …)` leg (a dropped `NewArg::Type`); the #51 fix left
//! the monomorphic app-lowering path deliberately unchanged. This pin
//! covers the monomorphic-over-user-ADT path.
//!
//! The fixture is inline and autonomous (single module, no imports, no
//! shared file, no kernel-tier RawBuf), minimised from the 3-module
//! 35-symbol `kem_2_counter_new.ail` reproducer: the match/print
//! scaffolding is dropped because the crash is at the `(new Counter 42)`
//! call-site lowering, independent of how the result is consumed.
use std::path::Path;
use std::process::Command;
fn ail_bin() -> &'static str {
env!("CARGO_BIN_EXE_ail")
}
fn write_tmp(src: &str) -> std::path::PathBuf {
let dir = std::env::temp_dir().join(format!(
"user_adt_new_mono_{}",
std::process::id()
));
std::fs::create_dir_all(&dir).unwrap();
let p = dir.join("user_adt_new_mono.ail");
std::fs::write(&p, src).unwrap();
p
}
/// The minimal autonomous trigger: a user ADT + a `new` fn + a `main`
/// that calls `(new Counter 42)` and binds the result.
const PROG: &str = r#"(module user_adt_new_mono
(data Counter
(ctor MkCounter (con Int)))
(fn new
(doc "Build a Counter initialised to the given value.")
(type (fn-type (params (own (con Int))) (ret (own (con Counter)))))
(params n)
(body (term-ctor Counter MkCounter n)))
(fn main
(type (fn-type (params) (ret (own (con Unit))) (effects IO)))
(params)
(body
(let c (new Counter 42)
(do io/print_str "ok\n")))))
"#;
#[test]
fn mono_new_over_user_adt_builds_and_runs() {
let src = write_tmp(PROG);
// `ail check` is clean today — the TypeDef-first ladder resolves
// `Counter.new`. This half already passes; it documents that the
// bug is NOT a check-layer rejection.
let check = Command::new(ail_bin())
.args(["check", src.to_str().unwrap()])
.output()
.expect("ail check failed to run");
assert!(
check.status.success(),
"ail check must accept `(new Counter 42)` over a user ADT; got:\n{}",
String::from_utf8_lossy(&check.stderr)
);
// The failing half (#53): `ail build --alloc=rc` aborts with
// `unknown variable: `Counter.new``. Once fixed, the build must
// succeed and the binary must run cleanly.
let out = std::env::temp_dir().join(format!("user_adt_new_mono_bin_{}", std::process::id()));
let build = Command::new(ail_bin())
.args(["build", src.to_str().unwrap(), "--alloc=rc", "-o"])
.arg(&out)
.output()
.expect("ail build failed to run");
assert!(
build.status.success(),
"ail build --alloc=rc must compile a monomorphic `(new Counter 42)` over a \
user ADT, but it failed (regression #53 — check↔codegen mismatch on the \
`Counter.new` dotted constructor callee):\n{}",
String::from_utf8_lossy(&build.stderr)
);
assert!(Path::new(&out).exists(), "build reported success but produced no binary");
let run = Command::new(&out).output().expect("execute compiled binary");
assert!(
run.status.success(),
"the compiled binary must run cleanly; stderr:\n{}",
String::from_utf8_lossy(&run.stderr)
);
assert_eq!(
String::from_utf8_lossy(&run.stdout),
"ok\n",
"the program prints `ok` after constructing the Counter"
);
}